Glossary
Super timeline
A single chronological view merging timestamps from the file system, registry, event logs and other artifacts, typically built with Plaso.
A super timeline merges the timestamps from many different evidence sources into one chronological view. Instead of examining the file system, the Registry, event logs, Prefetch and browser history separately, the analyst sees every event side by side, sorted by time: a file created in $MFT, a Run key LastWrite time, a logon in the Windows event logs and a download in the browser history can all appear within the same minute.
The reference open-source tool is Plaso: log2timeline extracts events from a disk image or triage collection into a storage file, and psort filters and exports them, for example to CSV or into Timesketch for collaborative review. The step-by-step guide on building a super timeline with Plaso walks through the process.
Super timelines are powerful but noisy. A full Windows system easily produces millions of rows, most of them routine activity. Work from known pivot points — an alert time, a malicious file, a suspicious logon — and filter by time window and source. Normalise everything to UTC (see UTC and local time) and remember that each source has its own timestamp semantics: MACB timestamps from the $MFT do not mean the same thing as a registry LastWrite time. Many analysts combine a targeted timeline of a few high-value sources with the super timeline for context.